qakbot | 6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557

Analysis

max time kernel
124s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-01-2022 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1338454339264410.dll
Size

1.6MB
MD5

8723cb4113dc8061fc8bb411829b4353
SHA1

99c75155c7a1aef5aa23c99256dc28905d9bc27b
SHA256

6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557
SHA512

47b4b573a96f512a7c946c2fca157ae333a3f4a73fc480a1fbce6f2511fd6e57e9de1a250c628ea7a2f556f538134ccfa30e3147932418a76ea84f56f2ce0f2a

Score

10^/10

qakbot obama152 1643038242 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

648 2832 WerFault.exe rundll32.exe

pid	pid_target	process	target process
648	2832	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2832	rundll32.exe
2832	rundll32.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 648 WerFault.exe
Token: SeBackupPrivilege 648 WerFault.exe
Token: SeDebugPrivilege 648 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	648	WerFault.exe
Token: SeBackupPrivilege	648	WerFault.exe
Token: SeDebugPrivilege	648	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3048 wrote to memory of 2832	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2832	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2832	3048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 712
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-118-0x0000000004AE0000-0x0000000004B01000-memory.dmp

Filesize
132KB

Download
memory/2832-119-0x0000000004AE0000-0x0000000004B01000-memory.dmp

Filesize
132KB

Download
memory/2832-120-0x0000000004A70000-0x0000000004AB3000-memory.dmp

Filesize
268KB

Download
memory/2832-121-0x0000000004AE0000-0x0000000004B01000-memory.dmp

Filesize
132KB

Download